Abstract:
A hierarchical network analytics system operated by a computing device or system is described. In some example techniques, the analytics system may determine results of a plurality of first level analyses each based at least in part on results of a respective plurality of data queries that return respective subsets of a plurality of types of network data. The analytics system may determine a result of a second level analysis based at least in part on results of the plurality of first level analyses.
Abstract:
Methods, systems, and computer program products are provided for generating an actionability measure for events occurring in a computing environment. A data retriever is configured to receive, in an event management system, an event indication generated in the computing environment regarding an event. In implementations, the event indication includes characteristics relating to the generation of the event. An actionability measure generator is configured to analyze the characteristics relating to the generation of the event. The actionability measure generator generates an actionability measure for the event indication based at least on the analysis of the characteristics, where the actionability measure defines an action level for the event indication. An automated action executor executes an action in the event management system for changing a state of the event indication that is dependent on the generated actionability measure.
Abstract:
Sensor data from multiple sensors associated with a user is received. The sensors may include sensors of a smart phone, and sensors associated with other devices such as fitness trackers, video game consoles, and cameras. The sensor data is processed to identify entities such as persons, locations, and objects that may be of interest to the user. A personal digital assistant application can present information related to the identified entities to the user, and can allow the user to perform various queries with respect to the identified entities, and previously identified entities. In addition, the identified entities can be used to trigger one or more rules including recording when and where a particular entity is identified, and generating an alert when a particular entity is identified.
Abstract:
Embodiments relate to detecting and mitigating network intrusions. Packets are inspected at their source/destination hosts to identify packet trends local to the hosts. The local packet trends are combined to identify network-wide packet trends. The network-wide packet trends are used to detect anomalies or attacks, which in turn informs mitigation actions. The local inspection may be performed by reconfigurable/reprogrammable “smart” network interfaces (NICs) at each of the hosts. Local inspection involves identifying potentially suspect packet features based on statistical prevalence of recurring commonalities among the packets; pre-defined threat patterns are not required. For network-wide coherence, each host/NIC uses the same packet-identifying and occurrence-measuring algorithms. An overlay or control server collects and combines the local occurrence-measures to derive the network-wide occurrence-measures. The network-wide occurrences can be used to automatically detect and mitigate completely new types of attack packets.
Abstract:
When a computing device has an issue, a detector receives (or retrieves) data associated with the computing device. The data may include parameter key-value pairs. The detector creates queries based on the data and distributes the queries to one or more matching engines, such as an exact matching engine or a proximity matching engine. The one or more matching engines look for matches in an index of database documents. The results from the one or more matching engines are ranked based on relevancy scores. In some cases, users may provide feedback regarding the relevancy of the results and the feedback may be used to recalibrate how the relevancy scores are determined.
Abstract:
Described herein are various technologies pertaining to providing assistance to an operator in a data center with respect to failures in the data center. An alarm is received, and a failing device is identified based upon content of the alarm. Failure conditions of the alarm are mapped to a failure symptom that may be exhibited by the failing device, and troubleshooting options previously employed to mitigate the failure symptom are retrieved from historical data. Labels are respectively assigned to the troubleshooting options, where a label is indicative of a probability that a troubleshooting option to which the label has been assigned will mitigate the failure symptom.
Abstract:
Methods for automatic and intelligent incident routing are performed by systems and apparatuses. The methods intelligently optimize routing of incidents to correct owners from a pool of many possible owners by utilizing learning models and algorithms based on feature vectors. Users provide information related to incidents of services or systems. The information is cleaned and featurized to generate a feature vector for the incident. The systems and apparatuses intelligently and automatically determine sets of candidate recipients based on outputs of algorithms, e.g., machine learning algorithms, such as classifiers using the feature vectors as inputs. Classifiers may utilize models or algorithms trained with featurizations used for feature vectors. Sets of candidate recipients are provided to users for selection of a recipient for the information from the set of candidate recipients instead of from all the possible recipients. Methods for intelligent bug and feedback routing are also performed by systems and apparatuses.
Abstract:
Bandwidth requirement specifications in a multi-tenant datacenter are implemented using resource-bundle level queues and tenant level queues. Data is transmitted via the resource-bundle level queues and the tenant level queues according to the bandwidth requirement specifications, such that minimum bandwidth requirements are maintained for data being transmitted and for data being received.
Abstract:
A hierarchical network analytics system operated by a computing device or system is described. In some example techniques, the analytics system may determine results of a plurality of first level analyses each based at least in part on results of a respective plurality of data queries that return respective subsets of a plurality of types of network data. The analytics system may determine a result of a second level analysis based at least in part on results of the plurality of first level analyses.
Abstract:
Disclosed herein is a system and method for searching or processing queries for searching for documents contained in a domain specific knowledge base. The system takes a query and generates from the query a modified version of the query by passing the query through one or more filters in a query processor. The query processor adds or removes terms from the query. The query processor can add or recognize that two words that appear to be separate words actually identify a specific software entity or can determine that a number appearing in a query is not just a number but refers to a specific version or a number relevant to the specific problem.